SaTC: CORE: Small: Decentralized Attribution and Secure Training of Generative Models

产生式模型描述了真实世界的数据分布，如图像、文本和人体运动，并在从照片编辑到自然语言处理再到自动驾驶的广泛且不断增长的应用中发挥着重要作用。关于生成性模型的开发和传播存在两个开放的挑战：(1)生成性模型的敌意应用已经针对社会技术干扰(例如，间谍活动和恶意冒充)而创建；(2)使用多个专有数据集(这是减少数据偏差所必需的)开发生成性模型会引起对数据泄露的隐私担忧。最近在这些挑战之后进行了立法努力，迄今为止，对条例的格式以及对其技术或社会可行性的了解有限。为此，该项目将开发新的数学理论和计算工具，以评估针对这些挑战的两种相互关联的解决方案的可行性：模型归属使所有者能够根据其生成的内容被正确识别；安全培训确保在可归因性生成模型的协作培训期间没有数据泄露。如果成功，该项目的成果将为今后的规章设计提供技术指导，以确保可再生模式的开发和传播。项目成果将通过项目网站、开放源码软件和公共数据集传播。该项目的影响将通过教育活动扩大，包括关于人工智能(AI)安全的新课程模块、本科研究项目，以及通过实验室参观延伸到当地社区，以培养具有技能的代表不足的群体，以减轻针对这些群体的恶意模拟和有偏见的数据/模型表示的风险。该项目将侧重于协同研究任务，以实现分散的模型归属和安全的生成模型培训。在前者中，研究团队将研究一套用户端生成性模型的系统设计，这些模型可以由一组二进制分类器来证明属性，这些二进制分类器以分散的方式存储以降低安全风险。分散归属的技术可行性将通过在可归属性、发电质量和模型容量之间的权衡来衡量。在后者中，研究小组将研究生成模型和相关的二进制分类器的安全多方训练以进行归因。将通过设计安全友好的模型架构和学习损失来平衡数据隐私和培训的可扩展性。将创造新的知识，将本项目与数字取证和安全计算方面的现有最先进文献区分开来：(1)将开发分散归属的充分条件，这将揭示可归因性、数据几何、模型架构和生成质量之间的分析联系。(2)充分的条件将能够估计给定数据集的属性模型的容量和生成质量容差。(3)研究了次线性安全向量乘法的可行性，从根本上提高了安全协同训练的可扩展性。(4)隐私友好的激活和丢失功能将用于培训用户端生成模型和用于归因的分类器。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Generative models describe real-world data distributions such as images, texts, and human motions, and are playing an essential role in a large and growing range of applications from photo editing to natural language processing to autonomous driving. There are two open challenges regarding the development and dissemination of generative models: (1) Adversarial applications of generative models have created concerning socio-technical disturbances (e.g., espionage operations and malicious impersonation); and (2) developing generative models using multiple proprietary datasets (which are needed to reduce data biases) raises privacy concerns about data leakage. Legislative efforts have recently been taken in the wake of these challenges, so far with limited consensus on the format of regulations and knowledge about their technological or social feasibility. To this end, this project will develop new mathematical theories and computational tools to assess the feasibility of two connected solutions to these challenges: Model attribution enforces the owners to be correctly identified based on their generated contents; secure training ensures zero data leakage during the collaborative training of attributable generative models. If successful, the outcomes of the project will provide technical guidance for future regulation design towards secure development and dissemination of generative models. Project results will be disseminated through a project website, open-source software, and public datasets. The impacts of the project will be broadened through educational activities, including new course modules on Artificial Intelligence (AI) security, undergraduate research projects, and outreach to the local community through lab tours, to prepare underrepresented groups with skills to mitigate risks from malicious impersonation and biased data/model representations targeting these groups.This project will focus on synergistic research tasks towards decentralized model attribution and secure training of generative models. In the former, the research team will study the systematic design of a set of user-end generative models that can be certifiably attributed by a set of binary classifiers, which are stored in a decentralized manner to mitigate security risks. The technical feasibility of decentralized attribution will be measured by the tradeoffs between attributability, generation quality, and model capacity. In the latter, the research team will study secure multi-party training of generative models and the associated binary classifiers for attribution. Data privacy and training scalability will be balanced through the design of security-friendly model architectures and learning losses. New knowledge will be created that differentiates this project from the existing state-of-the-art literature in digital forensics and secure computation: (1) Sufficient conditions for decentralized attribution will be developed, which will reveal analytical connections between attributability, data geometry, model architecture, and generation quality. (2) The sufficient conditions will enable estimation of the capacity of attributable models for a given dataset and generation quality tolerance. (3) Feasibility of sublinear secure vector multiplication will be studied, which will fundamentally improve the scalability of secure collaborative training. (4) Privacy-friendly activation and loss functions will be designed for the training of user-end generative models and the classifiers for attribution.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.